VBTI · Vibe-coding Type Indicator

• Outcome: Review
• Latest audit: May 28, 2026 · 10:03 AM UTC
• Version: 0.1.0

Overview

This novelty skill is not malicious, but it broadly analyzes private Claude transcript history and creates a shareable Desktop report without enough user control.

Review carefully before installing. Use it only if you are comfortable with all Claude project transcripts under ~/.claude/projects being locally analyzed, including prompts, pasted tool results, command patterns, file paths, and timing metadata. Inspect the generated Desktop HTML before sharing it, and be aware that opening it may contact Google Fonts through your browser.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill declares no permissions while instructing execution that reads local transcript history, writes an HTML file to the desktop, and invokes shell/open behavior. That creates hidden capability expansion: users and hosting systems cannot make an informed consent or enforce least privilege before the skill accesses sensitive local data and triggers side effects.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The stated purpose sounds like a lightweight personality quiz, but the described behavior performs deep local surveillance of transcript history, tool-use records, commands, paths, timestamps, and file activity. This mismatch is dangerous because it can cause users to authorize or invoke the skill without realizing the breadth of behavioral profiling and local data collection involved.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill performs an undisclosed side effect by launching the generated HTML in a local application after writing it to disk. Auto-opening is not required to fulfill the feature and increases risk because it causes immediate execution/rendering of locally generated content in the user's browser or default handler without explicit consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README describes behavior that scans local AI transcript history, generates an HTML file on the Desktop, and automatically opens it, but the user-facing invocation examples do not present a prominent, pre-execution warning about these privacy and filesystem side effects. This is risky because prior AI conversations can contain sensitive information, and converting derived content into a shareable artifact increases the chance of unintended disclosure.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill description says it will scan local transcript files, generate a desktop HTML file, and automatically open it, but provides no privacy notice or warning about filesystem and browser side effects. Users may unknowingly expose private content in the generated report or trigger actions on their machine they did not explicitly approve.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The core behavior scans all transcript files under ~/.claude/projects and derives personality-style judgments from historical conversations without any runtime notice, consent prompt, or scope restriction. This is dangerous because transcripts may contain secrets, personal data, and sensitive work context far beyond what a user expects from a lightweight personality card generator.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes a report to the Desktop and automatically opens it without an explicit warning before doing so. This is a privacy and surprise side-effect issue because Desktop artifacts are user-visible, easily screenshared, and may persist after the session, exposing derived information about the user's history.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The documented workflow explicitly repurposes the user's prior AI conversations into a diagnosis card intended for sharing, which creates a natural-language data exposure risk even if the output is summarized rather than raw. In this skill's context, that risk is elevated because transcript history commonly contains secrets, internal project names, personal data, or embarrassing content that may be surfaced, inferred, or indirectly revealed in the generated card.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill is explicitly designed to mine broad local conversation history and transform it into a shareable artifact for social posting. This is dangerous because even if the final card is summarized, it is derived from sensitive transcripts and normalizes reuse of private behavioral data for public-facing content.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The instructions direct the agent to read all transcript files under the user's project history and populate output with real data from them. In context, this makes the skill more dangerous because it is not operating on user-supplied input but on a broad corpus of historical local interactions that may contain secrets, proprietary code references, paths, and sensitive operational habits.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The skill collects and processes broad historical conversation content from local transcript storage without clear consent boundaries or minimization. In this context, the feature itself is built around profiling a user's prior interactions, which makes overcollection especially sensitive because the source data may include credentials, proprietary code, error dumps, and personal messages.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: extract_user_text intentionally flattens user text plus embedded tool_result content into a single analyzable string, which broadens the set of sensitive material being ingested. Tool results can contain command output, stack traces, tokens, file contents, or other secrets, so merging them into downstream analysis increases privacy exposure beyond ordinary chat text.

Static analysis

No suspicious patterns detected.